News for hackers. Stuff that matters.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by overshard on Monday April 08, 2013 @05:34PM (#5514784)
In other words, start using the `//url.to/something-here/` shortcut and the world will be a better place.

EDIT: Use `//` instead of `http://` or `https://` and it will use whatever the protocol of the page being fetched is using.

EDIT 2: Double check when you use the `//` shortcut that the website you are linking to supports HTTPS, some still don't and they don't redirect properly...

Re:Firefox 23 will block non-SSL content on SSL pages by def... by rachelbythebay on Monday April 08, 2013 @08:50PM (#5515763)
No, don't, unless you want bad things to happen when a whole bunch of corner cases start sprouting up. I did this for a while and ultimately gave up after seeing the error rate spike on my server. There are lots of people out there using stuff which just does not get the protocol-independent // scheme. I went back to doing either the whole thing (http[s]://host/path) or a relative thing (/path) but nothing in-between.

http://rachelbythebay.com/w/2012/09/15/rel/

Re:Firefox 23 will block non-SSL content on SSL pages by def... by StavrosK on Monday April 08, 2013 @09:42PM (#5515972)
I disagree with your conclusion. The fewer sites this works with, the quicker developers will fix it. Supporting the wrong way is not the right thing to do.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by carbocation on Monday April 08, 2013 @09:46PM (#5515989)
Your two viewpoints are reconcilable, I think.

From the standpoint of the individual developer, you handle edge cases like this so you don't break your clients' experience.

From the standpoint of the ecosystem, broken tools are bad, and they cause individual developers to have to handle more edge cases.

If one individual developer doesn't handle these edge cases, their clients will just think they are bad. If all of the individual developers decided not to handle these edge cases in a coordinated fashion, sure, they could trigger a change. But I don't think that's how it happens in the real world.

To look back on the days of IE6/IE7, most developers didn't just stop supporting these browsers and hope that their clients would stop using them; they supported the browsers until larger forces caused their clients to shift to newer browsers.

Getting back to my original point, I think it's possible for each of you to have the viewpoints that you have, but also for rachelbythebay to say, "Sure, if I could coordinate with all other devs to stop handling broken edge cases at the same time, I would do that," and for you to say, "Sure, I can see how you would want to keep your job and handle edge cases until they are fixed upstream."

Re:Firefox 23 will block non-SSL content on SSL pages by def... by StavrosK on Monday April 08, 2013 @09:54PM (#5516013)
I half-agree with rachelbythebay's position, but, in my experience, users will definitely say "hey, this site doesn't work with your service", the developer investigates and fixes it. It'd also probably be worth it to just email the devs of the service, it'd probably get fixed a significant proportion of the time.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by _pmf_ on Tuesday April 09, 2013 @02:33AM (#5516746)
> The fewer sites this works with, the quicker developers will fix it.

That turned out really well in the past.

Re:Firefox 23 will block non-SSL content on SSL pages by def... by StavrosK on Tuesday April 09, 2013 @05:03AM (#5517071)
Yeah, online services, desktop software, it's equally hard to upgrade both.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by hkolk on Tuesday April 09, 2013 @06:59AM (#5517301)
We are running one of the largest sites in the Netherlands with protocol-independend css/js/img: http://www.marktplaats.nl/ Haven't heard real complaints from the users about broken things. Probably anecdotal but it saves quite some complexity
Re:Firefox 23 will block non-SSL content on SSL pages by def... by vanderZwan on Tuesday April 09, 2013 @09:32AM (#5517912)
And in your spare time you are one of the best Dutch cartoonists around?
Re:Firefox 23 will block non-SSL content on SSL pages by def... by bct on Tuesday April 09, 2013 @11:11AM (#5518604)
What kind of "stuff"?
Re:Firefox 23 will block non-SSL content on SSL pages by def... by dudus on Monday April 08, 2013 @05:47PM (#5514861)
IE7 and IE8 will download stylesheets that use protocol relative urls twice.

http://stackoverflow.com/questions/4831741/can-i-change-all-...

Re:Firefox 23 will block non-SSL content on SSL pages by def... by acdha on Monday April 08, 2013 @08:16PM (#5515624)
But only for uncached resources - see Eric Lawrence's comment:

“Internal to Trident, the download queue has “de-duplication” logic to help ensure that we don’t download a single resource multiple times in parallel.

Until recently, that logic had a bug for certain resources (like CSS) wherein the schema-less URI would not be matched to the schema-specified URI and hence you’d end up with two parallel requests.”

http://www.stevesouders.com/blog/2010/02/10/5a-missing-schem...

You could use a resource loader if you really cared but with IE8 under 10% and dropping I'd recommend keeping your site clean and maintainable – anyone using IE8 at this point is used to the web being slow and ugly so something like this will be the least of their worries.

Re:Firefox 23 will block non-SSL content on SSL pages by def... by Achshar on Monday April 08, 2013 @05:58PM (#5514911)
IE certainly has strangest of bugs.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by somesay on Monday April 08, 2013 @06:35PM (#5515121)
You really care about that? Well, relative URLs (and maybe using a basename meta tag) might be a workaround. But seriously, I wouldn't care about these Microsoft's bugs.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by GauntletWizard on Monday April 08, 2013 @05:56PM (#5514901)
If this is a concern, you've made some very poor decisions.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by gcr on Monday April 08, 2013 @06:07PM (#5514975)
What about large assets, like big splash images? Those can be quite a bandwidth hog.

EDIT: from the post, IE8 only downloads stylesheets twice. Nevermind.

Re:Firefox 23 will block non-SSL content on SSL pages by def... by Achshar on Monday April 08, 2013 @06:00PM (#5514928)
Like what? Supporting ie 7 & 8? Using relative urls?
Re:Firefox 23 will block non-SSL content on SSL pages by def... by BadCRC on Monday April 08, 2013 @06:02PM (#5514944)
like worrying about twice as many hits to stylesheets (which are typically static content)
Re:Firefox 23 will block non-SSL content on SSL pages by def... by btipling on Monday April 08, 2013 @06:19PM (#5515046)
It's cached by URL, so I would assume (but haven't tested) that a different protocol would be cached separately.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by ErrantX on Monday April 08, 2013 @06:49PM (#5515206)
From a security perspective it certainly should be.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by jonny_eh on Monday April 08, 2013 @08:28PM (#5515687)
Why not just use https:// ?

That way, if you load the file using file:// it will still work. Any downsides?

Re:Firefox 23 will block non-SSL content on SSL pages by def... by jonknee on Tuesday April 09, 2013 @12:56AM (#5516505)
You will often need to dynamically generate all URLs depending on the current state of the page. A common example is an econmerce site where normal pages are HTTP, but things like the shopping cart and checkout are HTTPS. Your template will need to know to load resources as HTTPS when on a secure page. It's not the end of the world, but certainly annoying.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by Cthulhu_ on Tuesday April 09, 2013 @08:11AM (#5517553)
And are there any considerations nowadays to not just run the whole site under HTTPS?
Re:Firefox 23 will block non-SSL content on SSL pages by def... by timmow on Tuesday April 09, 2013 @09:06AM (#5517769)
Many CDNs charge a lot (10x for all bandwidth, including non secure) for https. If you are fronting one of your sites with these, it is not economically viable to switch over.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by kmfrk on Monday April 08, 2013 @06:22PM (#5515058)
A shame many linkification scripts won't support this in editors, though: //news.ycombinator.com/item?id=5514784.

Does anyone have any experience writing regex for this?

Re:Firefox 23 will block non-SSL content on SSL pages by def... by somesay on Monday April 08, 2013 @06:33PM (#5515110)
Just always use the https version then. There is nothing wrong in embedding https resources in http. `//` is just shorter and more flexible (e.g. you could switch of ssl if you want).
Re:Firefox 23 will block non-SSL content on SSL pages by def... by somesay on Monday April 08, 2013 @06:47PM (#5515194)
Hint: Local testing/loading of html files might require a local server then, since file:// is then used for resources, too, and this is rather problematic.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by stcredzero on Monday April 08, 2013 @06:50PM (#5515216)
You'll have to explain why local servers are problematic. More like file:// is.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by somesay on Monday April 08, 2013 @06:59PM (#5515291)
Well, if you double-click on a html file on your computer, it will open that in your browser using file://. If you use the short `//example.com/foo.bar`, it is quite problematic.

`//fonts.googleapis.com/css` becomes `file://fonts.googleapis.com/css` → doesn't work

Additionally, JavaScript files might not load or work due to browsers' (security) limitations. Not sure about the exact details here.

Re:Firefox 23 will block non-SSL content on SSL pages by def... by stcredzero on Monday April 08, 2013 @07:29PM (#5515432)
Definitely sounds like file:// is problematic, then.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by jtheory on Monday April 08, 2013 @08:17PM (#5515637)
Using a local server (instead of file:// access) would be a solution to that problem, not another problem.

That's not great...

A lot of folks get started editing HTML by downloading an existing page, editing it in some small way, and viewing the resulting page to see if it worked.

This would break that approach.

Re:Firefox 23 will block non-SSL content on SSL pages by def... by gingerlime on Tuesday April 09, 2013 @04:19AM (#5516983)
I agree, and I think not just for novice people editing HTML pages. Being able to load HTML pages locally, or send them in a zip file is important some times.

When I built Giraffe[1], a front-end for Graphite, one of my aims was that people can launch the dashboard from their desktop, then add dashboards to it by editing one file locally. So most of these people will use a server one day, but forcing them to launch a local server before they even start, really decreases the ability to play with it instantly and try it out... the code in giraffe's index.html needs to work both on the server and locally.

I already experienced strange behaviour with loading JSON/JSONP from a file:// based url, and I know it's an edge case, but it's still a useful use-case in my opinion.

[1]http://kenhub.github.io/giraffe

Re:Firefox 23 will block non-SSL content on SSL pages by def... by Hello71 on Monday April 08, 2013 @08:31PM (#5515699)
Firefox saves all assets to a _files directory then fixes the URLs to point in there.

If you really, really want to use //:

  busybox httpd -p 8080
Re:Firefox 23 will block non-SSL content on SSL pages by def... by khuey on Monday April 08, 2013 @08:44PM (#5515742)
or python -m SimpleHTTPServer 8080
Re:Firefox 23 will block non-SSL content on SSL pages by def... by fein on Monday April 08, 2013 @10:05PM (#5516047)
Hell, even new PHP comes with a packaged local dev server.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by TeMPOraL on Tuesday April 09, 2013 @01:34AM (#5516614)
But it would suck that you'd have to launch a server just to view an HTML file locally... (actually, the problem is already here for some time, thanks to JS requiring protocols to match to fetch data).
Re:Firefox 23 will block non-SSL content on SSL pages by def... by kyrias on Monday April 08, 2013 @08:18PM (#5515643)
It's not file:// that's problematic, it's that you're using relative protocol URLs without an actual server to be relative to
Re:Firefox 23 will block non-SSL content on SSL pages by def... by somesay on Tuesday April 09, 2013 @06:48AM (#5517265)
Guy, you haven't got this right.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by jgreen10 on Monday April 08, 2013 @06:27PM (#5515080)
Good thing Tim-Berners Lee put two slashes in there.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by stcredzero on Monday April 08, 2013 @06:48PM (#5515203)
Not only are even smart people sometimes wrong about stuff, they're wrong about when they're wrong about stuff.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by dnr on Monday April 08, 2013 @09:06PM (#5515827)
If there were zero or one slashes there, we could use urls starting with a colon for the same purpose.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by speleding on Wednesday April 10, 2013 @09:06AM (#5524831)
I agree that using protocol relative URLs is the way to go, but there is one particular situation to watch out for: if the user saves the page to disk and opens it again then // will become file:// and all relative links will be broken.

So on something like an "invoice" page that the user is likely to want to save you may not want to do that (or use a piece of javascript to rewrite the links dynamically)

Re:Firefox 23 will block non-SSL content on SSL pages by def... by lenkite on Wednesday April 10, 2013 @02:22PM (#5526984)
Egad! Yet another edge case to remember.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by thezilch on Monday April 08, 2013 @05:43PM (#5514838)

  some still don't...
Most still don't!
Re:Firefox 23 will block non-SSL content on SSL pages by def... by benjiweber on Tuesday April 09, 2013 @01:31AM (#5516606)
Annoyingly there's an obnoxious popup on IE6 when doing this

http://paulirish.com/2010/the-protocol-relative-url/

Not using protocol relative urls causes a great amount of pain. Unfortunately when you're building content for third party pages you need more graceful degradation than focus stealing dialogues.

Re:Firefox 23 will block non-SSL content on SSL pages by def... by ck2 on Tuesday April 09, 2013 @08:43AM (#5517654)
Unless you are supporting China, IE6 usage is below 1% in virtually all countries: https://news.ycombinator.com/item?id=5511627
Re:Firefox 23 will block non-SSL content on SSL pages by def... by dorward on Tuesday April 09, 2013 @11:22AM (#5518702)
That article says the problem is with the way SSL is set up on the host in the example, not with scheme relative URIs.
Re:Firefox 23 will block non-SSL content on SSL pages by def... by speleding on Wednesday April 10, 2013 @09:25AM (#5524951)
No, protocol relative URLS work fine in IE6. (The article you linked to doesn't say they don't)
Re:Firefox 23 will block non-SSL content on SSL pages by def... by buttscicles on Tuesday April 09, 2013 @05:03AM (#5517072)
>and they don't redirect properly

You can't redirect SSL > non-SSL without a browser warning though, right? Unless you get a cert, at which point you may as well put it to use.